| عنوان | Jinher OA V1.0 SQL Injection |
|---|
| الوصف | A critical SQL injection vulnerability has been discovered in the 'attendance_out_approve.aspx' component of Jinher OA. The affected parameter is 'httpOID', which is used to retrieve or manipulate plan-related data. Due to improper sanitization of user-supplied input before incorporating it into SQL queries, an attacker can inject arbitrary SQL commands into the backend database. This flaw is especially dangerous because it does not require any form of authentication — even unauthenticated remote attackers can exploit it by sending specially crafted HTTP requests to the vulnerable endpoint.
|
|---|
| المصدر | ⚠️ https://github.com/pangdudu24/cve/issues/1 |
|---|
| المستخدم | pangdudu24 (UID 99307) |
|---|
| ارسال | 26/06/2026 02:11 PM (2 أشهر منذ) |
|---|
| الاعتدال | 14/08/2026 09:43 PM (2 months later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 390110 [Jinher OA 1.0 attendance_out_approve.aspx httpOID حقن SQL] |
|---|
| النقاط | 20 |
|---|